Case file CF-003 Classification public — sanitized Domain vulnerability management Status published

// casefiles/vuln-management

Risk-Led Triage Across an Enterprise Estate

There are always more vulnerabilities than any team can fix. This case file is about the control that actually matters: deciding which ones deserve the next engineering hour, and driving those to closure.

RoleSecurity Analyst
ContextEnterprise retail estate
ToolingNessus · group VM tooling
FrameworksCVSS · OWASP · CIS · MITRE
ProgrammeVM + bug bounty support
Period2024 — 2026

01 Briefing

An enterprise estate produces vulnerability findings faster than any team can remediate them — scanners, penetration tests, and a bug-bounty programme all feeding the same queue. Treating that queue as first-in-first-out, or even highest-CVSS-first, means spending scarce engineering time on the wrong risks.

The job documented here: turn a raw finding firehose into a defensible, risk-ranked remediation programme — and get the fixes actually shipped by teams whose day job is something else.

02 Threat model

The queue mixes three very different kinds of finding, and the triage has to tell them apart:

  • Exploited-in-the-wild — vulnerabilities with threat-intelligence evidence of active exploitation; the clock is already running.
  • High-severity-on-paper — critical CVSS scores on assets that are isolated, compensated, or carry little business impact.
  • Externally reported — bug-bounty submissions, where validation and researcher communication precede any score.

03 Method

Exhibit A — triage pipelineevery finding, same path
  1. Aggregate — infrastructure scans (Nessus), group VM tooling, and bug-bounty submissions land in one queue.
  2. Validate & deduplicate — confirm the finding is real, reachable, and not already tracked.
  3. Score — CVSS as the baseline severity, applied consistently, never as the final answer.
  4. Overlay threat intelligence — active exploitation, exploit maturity, and exposure reorder the queue; OWASP and CIS benchmarks frame the weakness class.
  5. Prioritise by business risk — asset criticality and blast radius decide what the next engineering hour goes to.
  6. Drive to closure — remediation with the owning team, or a formal risk-acceptance decision with an owner and a review date. Nothing exits the queue silently.
The funnel narrows at every stage — the discipline is that findings leave only through remediation or explicit, owned acceptance.

04 Findings

Key Finding Severity is not risk. CVSS-only ranking over-prioritises unreachable criticals and under-prioritises actively exploited mediums — the threat-intelligence overlay is what makes the queue match reality.
  • Remediation velocity is a relationship problem. Fixes shipped fastest where the security team turned findings into clear, scoped asks for the owning team — partnership, not ticket-lobbing.
  • Exceptions need a formal path. A risk-acceptance process with named owners and review dates keeps "we'll fix it later" honest — deferred risk stays visible instead of dissolving.
  • Bug-bounty findings punch above their CVSS. An external researcher reaching a vulnerability is itself exposure evidence, and triage weighs that accordingly.

05 Impact

  • Engineering time lands on the highest business risk — not the loudest scanner or the scariest score.
  • Risk decisions became auditable — every finding closes through remediation or an owned, dated acceptance, which is exactly what a regulator or auditor asks to see.
  • Security speaks the business's language — "this is exploited in the wild and touches the payment path" moves a roadmap in a way "CVSS 9.8" never does.
Next file · CF-001 Decoding Malicious Camouflage
Open channel